Threats tagged 'ghsa-fgpc-h3x4-vmw3'

The WS Form LITE WordPress plugin up to version 1.12.18 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'field_<id>[0][0]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The issue is due to the client-side esc_html() helper improperly handling non-string values, enabling nested-array payloads to bypass escaping and reach jQuery .append() unescaped.